Description
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | request node module | >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | node-request | 2.88.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | request | >= 2.49.0, < 2.68.0 | 2.68.0 | GHSA-7xfp-9c55-5vqj |
| npm | request | >= 2.2.6, < 2.68.0 | 2.68.0 | GHSA-7xfp-9c55-5vqj |